c25313a219a29967c25a7abb7c45821f22eea83df9fc03210514888d3dc043fa

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65e60e3139a2fa7bbff65a0cc8200283.exe
Size

68KB
MD5

65e60e3139a2fa7bbff65a0cc8200283
SHA1

bc786ab70ee21fab4e83e4591f9d98f4d8f9db95
SHA256

c25313a219a29967c25a7abb7c45821f22eea83df9fc03210514888d3dc043fa
SHA512

0e79b297c268d7b11555d113774253c966f836fd18c60add2c3f7bbe4a848fdfc518d43be3fb7b190e12c789542eeb44c7981b2d370f9993fbc5c87e45a7d4eb
SSDEEP

1536:w5neEhlcTW5sk1jtf2XvWINndIcN6JsGs5g7SUV/0p:Wnj9jtfU+INndIc0JK5i10p

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2968	Troy.exe

Loads dropped DLL 6 IoCs

pid	Process
2612	65e60e3139a2fa7bbff65a0cc8200283.exe
2612	65e60e3139a2fa7bbff65a0cc8200283.exe
2968	Troy.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	65e60e3139a2fa7bbff65a0cc8200283.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	2968	WerFault.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2968	2612	65e60e3139a2fa7bbff65a0cc8200283.exe	28
PID 2612 wrote to memory of 2968	2612	65e60e3139a2fa7bbff65a0cc8200283.exe	28
PID 2612 wrote to memory of 2968	2612	65e60e3139a2fa7bbff65a0cc8200283.exe	28
PID 2612 wrote to memory of 2968	2612	65e60e3139a2fa7bbff65a0cc8200283.exe	28
PID 2612 wrote to memory of 2968	2612	65e60e3139a2fa7bbff65a0cc8200283.exe	28
PID 2612 wrote to memory of 2968	2612	65e60e3139a2fa7bbff65a0cc8200283.exe	28
PID 2612 wrote to memory of 2968	2612	65e60e3139a2fa7bbff65a0cc8200283.exe	28
PID 2968 wrote to memory of 2304	2968	Troy.exe	29
PID 2968 wrote to memory of 2304	2968	Troy.exe	29
PID 2968 wrote to memory of 2304	2968	Troy.exe	29
PID 2968 wrote to memory of 2304	2968	Troy.exe	29
PID 2968 wrote to memory of 2304	2968	Troy.exe	29
PID 2968 wrote to memory of 2304	2968	Troy.exe	29
PID 2968 wrote to memory of 2304	2968	Troy.exe	29

C:\Users\Admin\AppData\Local\Temp\65e60e3139a2fa7bbff65a0cc8200283.exe
"C:\Users\Admin\AppData\Local\Temp\65e60e3139a2fa7bbff65a0cc8200283.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Troy.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Troy.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 264
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Troy.exe

Filesize
7KB

MD5
a64a49684f78a58fac079b03cadb1617

SHA1
bec8759e77e88b2804e4c30f19ba5c39eca8efb8

SHA256
8b0e45801f3abf6385f8bdfbdffd2225e697af7c0e428b0998190937a2cc6692

SHA512
d35f57b74effb4823ddcc8bedf8310a63231c6d5686f91c6089f8c66c6c4129c430b667e4d2cb7c851d684147be6d4d650d0b4a8e68abba3816b246674735e73

Download Submit
memory/2612-4-0x0000000000210000-0x0000000000214000-memory.dmp

Filesize
16KB

Download
memory/2968-12-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2968-13-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads